v2.0.10 — external-contrib-notify: parameterize Harden-Runner

Summary

Closes the last cross-workflow asymmetry. All four workflows that use Harden-Runner (go-ci, go-security, claude-code, external-contrib-notify) now parameterize it via the same 3-input pattern.

Changes to external-contrib-notify.yml

• Added enable-harden-runner (bool, default true)
• Added harden-runner-policy (audit | block, default audit)
• Added harden-runner-allowed-endpoints (newline-separated, default "")

Defaults preserve today's behavior. Zero caller breakage.

For callers who want to enable block mode

jobs:
  notify:
    uses: praetorian-inc/public-workflows/.github/workflows/external-contrib-notify.yml@135c50049eeef6e664bd7ea4aacaa33118083e30  # v2.0.10
    with:
      harden-runner-policy: "block"
      harden-runner-allowed-endpoints: |
        api.github.com:443
        api.linear.app:443
        slack.com:443
        hooks.slack.com:443
    secrets: inherit

Why this matters

external-contrib-notify.yml handles high-value secrets (LINEAR_API_KEY, SLACK_BOT_TOKEN, GitHub App private key). Block mode prevents exfiltration to attacker-controlled domains if the workflow ever runs compromised code.

Caller pin line

uses: praetorian-inc/public-workflows/.github/workflows/external-contrib-notify.yml@135c50049eeef6e664bd7ea4aacaa33118083e30  # v2.0.10

Backwards compatible — rebump at your convenience.